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Abstract — In this paper we propose a technique to bhndly 
synthesize the generator polynomial of BCH codes. The proposed 
technique involves finding Greatest Common Divisor (GCD) 
among different codewords and block lengths. Based on this 
combinatorial GCD calculation, correlation values are found. For 
a valid block length, the iterative GCD calculation results either 
into generator polynomial or some of its higher order multiples. 
These higher order polynomials are factorized under modulo-2 
operation, and one of the resulting factors is always the generator 
polynomial which further increases the correlation value. The 
resulting correlation plot for different polynomials shows very 
high values for correct block length and valid generator polyno- 
mial. Knowing the valid block length and generator polynomial, 
all other parameters including number of parity-check digits 
(n fc), minimum distance dmin and error correcting capability 
t are readily exposed. 



Index Terms — GCD, blind estimation, generator polynomial, 
correlation value. 



I. Introduction 

Error control coding is mandatory to combat unavoidable 
random and burst errors in digital communication channel. 
There exist various error control codes amongst which Bose- 
Chaudhuri-Hocquenghem (BCH) cyclic codes are very famous 
and widely used in digital communication channels. These 
codes are characterized by block length n, number of parity- 
check digits (n—k) and minimum distance (i„ii„.The generator 
polynomial of BCH codes is specified as Least Common Mul- 
tiple (LCM) of minimal polynomials 4)i{X) where 1 < i < 2t, 
t being error correcting capability of the code. 

In a problem of eavesdropping a communication channel, 
no prior knowledge is available except the eavesdropped 
bitstream. The source information is packed into a number 
of different layers before sending it to the communication 
channel. In this scenario, one has to blindly estimate different 
parameters at each layer Very few papers deal with the 
problem of synthesis and reconstruction of error control codes 
from eavesdropped bitstreams. Rice [l] presented a technique 
to estimate the parameters of rate 1/n convolutional code 
which was generalized by Filiol Q for other rates as well as 
for punctured convolutional codes. Burel |3| suggested blind 
estimation of encoder and interleaver characteristics based on 
linear algebra theory. Barbier H analyzed different techniques 
to blindly recover the parameters of turbo-code encoder In 
2006, Cluzeau |5| introduced a version of Gallager algorithm 
with weighted parity-check equations to recover LDPC and 
other block codes. 



In this paper, synthesis-by-analysis of BCH codes is pre- 
sented. The proposed technique focuses on the parameter 
estimation at channel coding layer in general and on BCH 
codes in particular. In our work, the key parameter to be 
estimated is the generator polynomial for a valid block length 
71. Knowing the valid block length n and generator polynomial 
g{X), all other parameters can be readily found and BCH 
codes can be decoded without any prior knowledge of the 
transmission side. 

We assume that we have access to the eavesdropped BCH 
encoded bitstream. This assumption is simulated by generating 
test vectors for a range of BCH codes {n,k,t). For a specific 
(n, fc, t) code, the test vectors are passed to the proposed 
algorithm and GCD is found for two codewords in first 
iteration. The algorithm then steps through different available 
codewords in a combinatorial manner For each combination 
of codewords, the GCD value is used to find correlation for 
different candidate polynomials. For valid block length and 
correct generator polynomial, this correlation accumulates to 
a very high value. For some pair of codewords the generator 
polynomial is not exposed, however by factorizing the detected 
polynomial under modulo-2 operation, the desired generator 
polynomial is retrieved and the correlation value increases fur- 
ther Upon plotting the correlation values, the desired generator 
polynomial for valid block length is exposed very explicitly. 

The proposed technique exploits the cyclic relationship 
between codewords of BCH codes. This technique works 
perfectly for noiseless bitstream. However, it is equally valid 
if there are certain errors in some of the codewords. Since this 
is an analysis technique unlike realtime decoding, the effects 
of noisy codewords can be reduced by increasing the number 
of codewords. The correlation value accumulates for increased 
number of test vectors with very mild increase in processing 
and hence the algorithm works for noisy bitstream as well. 

This paper is organized as follows. In Section II, we recall 
the principles of BCH code construction along with standard 
procedure to generate test vectors. Section III gives a refresher 
about GCD and Euclid's algorithm following the detection of 
generator polynomial mathematics in Section IV. Simulation 
results are shown in Section V. 

II. BCH CONSTRUCTION 

Given any positive integer m (m > 3) and error correcting 
capability t {t < 2™^^), a BCH code can be generated with 
the following parameters:- 

Block Length: n = 2™-\ 
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Minimum distance: rfmm > 2t + 1, 

Number of parity-check digits: n — k < mt, 

The generator polynomial g{X) is the LCM of 

g{X) ^ LCM{MX),MX),- ■ ^MX)} (1) 

Since every even power of primitive element a has the same 
minimal polynomial as some preceding odd power of a, hence 
dl) can be reduced to:- 

g{X) = LCM{MX),MX),-- ■,(l>2t-i{X)} (2) 

Test vectors (encoding in systematic form) are generated by 
following the standard encoding steps 16) which are:- 

1) Pre-multiply, k information digits, message polynomial 
with X"-*" i.e. X"~''u{X). 

2) Calculate parity check polynomial b{X) from dividing 

by g{X). 

3) Append b{X) with X"^''u(X) to obtain the code poly- 
nomial v{X) = b{X) + X"-''u{X). 

The above steps can be realized by a division circuit based 
on Unear {n~k) stage shift register with feedback connections 
based on g{X) as shown in Figure [T] 




Fig. 1. Encoding circuit for an (n, k) cyclic code with generator polynomial 
g{X) = 1 + 3iX + giX^ + ■■■ + g„-k-iX"-''-'' + X^~^ 

The operation of the encoding circuit |6| is described as 
follows: 

1) Initially, the gate is turned on. The, k information digits, 

message polynomial — uq+uiX-\ \-Uk-iX^^'^ 

is fed to the circuit as well as transmitted into the 
channel. Feeding the k information digits into the circuit 
is equivalent to pre-multiplying u{X) by X"^*^. When 
all k information digits are shifted into the circuit, the 
(?i — k) digits in the register form the remainder. 

2) The gate is then turned off, since the register now 
contains the desired {n — k) parity check digits. 

3) Selector is changed to the right position to send parity 
check digits into the channel. These (n — fc) parity check 
digits along with k information digits form the cyclic 
codeword in systematic form. 

III. Greatest Common Divisor 

To have insight into the detection algorithm, some basic 
definitions |7| are described as follows:- 

• Common Divisor: An element a is a common divisor 
of a collection of elements 6i, ■ • j &)i if a divides all 
elements of hi for i = 1, 2, ■ ■ •, n with remainder zero. 



• Greatest Common Divisor: If d is a common divisor of 
hi and all other common divisors are less than d, then d 
is called the greatest common divisor (GCD) of the hi. 

Euclid's algorithm fT) is very famous for fast GCD calcu- 
lations. This algorithm is outlined as follows:- 

1) Let a, 6 be two elements where a > h. 

2) Let ri take on initial value r_i = a and rg = h. 

3) If rj_i 7^ 0, then define n using rj_2 + Qiri-i = n, 
where < r^-i. 

4) If ri ~ 0, then rj_i = GCD{a, h), else goto step 3. 

In our work, Euclid's algorithm over polynomials is used 
to find GCD among different code polynomials. The code 
polynomials are passed to the algorithm in a combinatorial 
manner to maximize the correlation value for desired generator 
polynomial. 

IV. Detection of Generator Polynomial 

For cyclic codes, every codeword in code space C is ob- 
tained by polynomial multiplication of message and generator 
So this algebraic structure can readily reveal the generator 
polynomial in code polynomials. For the sake of clarity, we 
prove the following :- 

Proposition: The GCD polynomial, dc{X) of any two code 
polynomials from code space C contains generator polyno- 
mial, g(X) as one of its factor 

Proof: Let GCD(mi (X), m2(X)) = d„(X) 
where 1 < drn{X) < min{mi{X),m2{X)) for any 
mi(X),m2(X) e M 

By definition of cyclic codes, we have Ci{X) = 
miiX)g{X) and C2{X) = m2{X)g{X) 
Therefore 

GCD{ci{X),C2{X)) = GCD{mi{X)g{X),m2{X)g{X)) 
= g{X).GCDimi{X),m2{X)) 
= g(X).d„(X) 
= dc{X) 

Hence the proof. 

Corollary: If mi(X) and m2{X) are co-prime, then 
GCD(mi(X),m2(X)) = 1 then cd = g{X) 

For illustration purpose, (7, 4) cyclic code generated by 
g{X) = 1 + X + X^ is chosen. Some of the message vectors, 
code vectors and code polynomials are shown in Table H] 

Each code polynomial of cyclic code carry the shift relation- 
ship, imparted by g{X), which can be exploited by calculating 
the GCD for any two code polynomial. Let two non-zero 
noiseless dissimilar code polynomials vi{X) and V2{X) are 
transmitted. The received code polynomials are:- 

r,{X)^v,{X) + e,{X) 
r2{X) ^ V2{X) + e2{X) 

Since code polynomials are assumed to be noise-free hence 
ei{X) — 62 (X) = and ^ are reduced to:- 

n{x)^v,{x) 

r2{X) = V2{X) 
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TABLE I 

Code Polynomials for (7,4) cyclic code 



Message 
Vector 


Code 
Vector 


Code 
Polynomials 


1000 


1101000 


X^+X + l = g(X) 


1010 


0011010 


= X^g(X) 


0110 


1000110 


+ X* + 1 = (X^ + X + l)g(X) 


1110 


0101110 


X^ + X* + X'^ + X = (X^ + ^)g(X) 


1001 


0111001 


X" + X'^ + X^ + X = (X'^ + X)g(X) 


0111 


0010111 


X" + X^' + X-* + X^ = (X-* + X^)g(X) 



The GCD calculation on these noise-free code polynomials 
results into detection of g{X) either without factorization or 
with factorization under modulo-2 operation. 

A. No Factorization for g{X) 

Suppose niX) = X^ + X"^ + X^ + X^ and r2{X) = 
1 + X + X^ from Table |T] are received . Division operation 
will result in a{X) = q{X)h{X) + r{X), where a{X) and 
b{X) are first and second code polynomials respectively, q{X) 
is the quotient polynomial, r{X) is the remainder polynomial 
and + shows modulo-2 addition. 

X^ +X^ + X^ +X^ = +x + x'^) 

+ (X^ + + X^) ^ r(X) ^ 

Carry on with Euclid's algorithm till r{X) becomes zero. 
X"^ + X^ + X^ ^ X^.{1 + X + X^) 
+ r(X) = 

Since r{X) is zero, hence q{X) = 1 + X + X^ is the 
greatest common divisor of ri{X) and r2{X). Hence GCD of 
two code polynomials directly results into g{X). 

B. Factorization for g{X) 

Now suppose ri {X) = X + X^ + X^ + X^ and r2{X) = 
X2 + + ^5 + X^ from Table |I] are received. The GCD 
calculation will proceed as follows: 

X + X"^ + X^ + X^ = 1.(^2 + X* + x"^ + X^) 
+ (X + X^ +X^ +X^) 

^ r(X) ^ 

Carry on with second iteration. 

x^ + x^ + X-' + X^ = X.{X + x^ + x* + x'^) 

+ ^ => r(X) = 

Since r{X) is zero, hence q{X) ^ X + X^ + X'^ + X^ 
is the greatest common divisor of ri{X) and r2{X). At first 
glance it looks very different from g{X) but it can be reduced 
to g{X) by factorization under modulo-2 operation. 

X + X^ + X"^ + X^ = {X.^ + X + 1){X^ + X) 

g(X) 



Hence GCD exploited the cyclic shift relation between code- 
words along with factorization (if needed) under modulo-2 
operation to detect generator polynomial. 

V. Simulation Results 

The algorithm is tested on a wide range of (n, k, t) com- 
binations of BCH codes. The code polynomials from the test 
vector are stepped through the algorithm in a combinatorial 
manner The GCD of first code polynomial is calculated with 
all other code polynomials in a descending order. Then GCD 
of second code polynomial is calculated with all other code 
polynomials in a descending order. This process is continued 
till GCD calculation of last two candidate code polynomials. 
The resulting polynomials are correlated and the correlation 
value for the generator polynomial of test vectors is found to 
be very high. For illustration purpose, fifty BCH codewords, 
encoded by (31, k, t) parameter, are chosen. These code poly- 
nomial are given to the algorithm for two different scenarios:- 

A. Known Block Length 

In first case, by fixing the block length, first fifty code 
polynomials are passed to the algorithm. The simulation results 
for (31, 26, 1), (31, 21, 2), (31, 16, 3) and (31, 11, 5) codes are 
shown in Figure |2] In these figures, polynomial (octal form) 
are plotted on horizontal axis and corresponding correlation 
values are plotted on vertical axis. 

In Figure |2] {a, b, c & d}, correlation values of 929, 987, 
868 and 985 for polynomials p[X) = 45, p{X) = 3551, 
p{X) = 107657 and p{X) — 5423325 are shown respectively. 
These p{X) corresponds to generator polynomial g{X). The 
above correlation values correspond to fifty noiseless code 
polynomials. This value depends on number of code poly- 
nomials chosen and the noise present in code polynomials. In 
case of noisy code polynomials, this value can be smaller and 
it can possibly be increased by increasing the number of code 
polynomials for GCD calculation. Correlation value found for 
p{X) = g{X) in different simulations is reasonably high as 
compared to all other polynomials. 

1 ) Competitive Polynomial Analysis: The competitive cor- 
relation values (Figure 121 a)) for octal polynomials 157, 261, 
631, 373, 723, 1341, 1711, 1253, 2747 and 4331 can be 161, 
33, 21, 17, 9, 5, 4, 3, 2 and 1 respectively. For illustrative 
purpose only unique correlation values and corresponding 
polynomials are chosen for analysis. If the chosen polynomials 
are factored under modulo-2 operation, they result into the 
desired generator polynomial. This can be shown as follows:- 

p{X) = 157(orf) 

= X^ + X^ + X^ + X^ + X + 1 
^{X + 1) (X^ + X^ + 1) 

" v ' 

p{X) = 261(od) 

^ X'^ + X^ + X^ + 1 
= {X + 1)2 (X^ +X2 + 1) 

" v ' 

p{X) = 631{oct) 
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Generator Polynomial (Octal) 
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(a) (31,26,1) BCH code 



(b) (31,21,2) BCH code 
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(c) (31,16,3) BCH code 
Fig. 2. Simulation results for (31, k,t) BCH code. 



(d) (31,11,5) BCH code 



PiX) 



p{x) 



PiX) 



PiX) 



= + X"^ + X"^ + + 1 

= (X3 + X2 + 1)(XS+X2 + 1) 



= 373(orf) 
X'' + X^' + X^ + X^ + X^ + X + 1 
= {X^+X + 1) (X^ + X=^ + 1) 

= 723{oct) 
= X^ + X'' + x^ + x-^ + X + 1 
==(X + 1)3(X^+X^ + 1) 

= 1341 (oct) 
= X^ + X'' + X^ + X'' + 1 



= {X^ + X + 1)^ {X.^ 



1) 



= 1711(oct) 

= X^ + X^ + X'^ + X^ + X^ + 1 

(X + 1){X'^ + X + 1){X^+X^ + 1) 
. ' 

= 1253(oct) 

= X^ + X'^ + X^ + X^ + X + 1 
= (X^ + X^ + I) (X^ + + 1) 



PiX) 



PiX) 



= x^ 



= 2747(orf) 

X'' + X^ + X" 



X^+X + 1 



= (X + 1){X^ + X'^ + 1) (X^ + X^ + 1) 

^ V ' 

= 4331 (oc<) 
= X^^ + X'^ + X^ + X^ + X^ + 1 
{X + 1){X^ + X"^ + X^ + X + 1) (X^ + x^ 



Although g{X) = 4100200401(oct) seems to be very 
complicated but it gets factored and one part is again the 
desired polynomial. 

p{X) = 4100200401(orf) 



x^^ + x"^^ + X^^ + X^ + 1 



+ x' 



X' 



x" 

1) 



' + + 1) 

x^ + x^ + 



X^ + 1) 



= ix' 

(X^ 

(X^ + x^ 

{X^ +X^ + 1) 

2) Correlation for Incorrect block length: If the block 
length is incorrect, a very intuitive correlation trend can be 
seen. It is obvious that giX) ~ l{oct) = 1 is a factor of 
every higher order polynomial, so its correlation value has 
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to be higher than all other polynomials. Similarly irreducible 
polynomials (1+X), {l+X+X"^) etc can be factors 

of some higher order polynomials and hence they will show 
higher correlation values as compared to other candidates. This 
trend can be seen in Figure [3] 



1000 



i: 



U 




Generator Polynomial (Octal) 



Fig. 3. Correlation trend for incorrect block length 

B. Unknown Block Length 

The second scenario is simulated for g{X) 



45 (oci) with a block length of 31. The algorithm is run by 
varying the block length for a range of values e.g. n = 25 to 
50. Here maximum correlation (close to the desired polyno- 
mial) is found for g{X) ~ 1 as compliant to correlation trend 
shown in Figure |3] It is obvious that g{X) — 1 cannot be a 
generator polynomial of binary primitive BCH code as it does 
not meet n — k < mt criterion. In Figure |4] correlation value 
bar is plotted along with corresponding polynomial bar Here 
the polynomial bar is invisible for incorrect block lengths, 
however polynomial bar along with corresponding correlation 
bar is high enough to show that the correct block length is 3 1 
with a generator polynomial g{X) = X^ + X'^ + 1 = 45(oct). 



in a combinatorial manner and finds the corresponding maxi- 
mum correlation. It takes into account two possible scenarios 
of known and unknown prior knowledge of block length. The 
simulation results show that the correlation for the noiseless 
code polynomials is very high as compared to other candidate 
polynomials which are in fact not the competitive polynomials 
but they are some higher order multiples of generator polyno- 
mial. These high order multiples can be reduced to generator 
polynomial by factorization under modulo-2 operations. 

In simulation, only noiseless codewords are used, however 
intuitively it can work on noisy codewords as well. The only 
minute difference will be reduction in a correlation value due 
to noise effects. This reduction in correlation value can be 
taken care of by passing large number of codewords to the 
algorithm. 
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Fig. 4. Correlation results for variable block length 



VI. Conclusion 

The proposed algorithm exploits the cyclic relationship 
between code polynomials of BCH codes. It calculates greatest 
common divisor between different received code polynomials 



